Critical Security Update for PHP Package: php-pecl-apcu, php-pecl-redis6, and Others
Summary
RLSA-2026:1429: Important: php:8.3 security update. Affects php-pecl-apcu across 2 version ranges.
< 0:5.1.23-1.module+el9.7.0+40004+bf50a568
< 0:5.1.23-1.module+el9.7.0+40005+715283ec
Fixed in 0:5.1.23-1.module+el9.7.0+40004+bf50a568 or 0:5.1.23-1.module+el9.7.0+40005+715283ec, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHP is a widely-used open-source scripting language designed for web development, particularly in conjunction with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The affected packages, including php-pecl-apcu, php-pecl-redis6, and others, are extensions that enhance PHP's capabilities, providing functionalities like caching, Redis support, and more. These packages are integral to many web applications, making their security paramount.
Vulnerability Detail
The vulnerability stems from multiple security flaws in PHP, including a heap-based buffer overflow in the array_merge() function, which could allow an attacker to execute arbitrary code. Additionally, there is an information disclosure risk via the getimagesize() function when handling multi-chunk images, and a Denial of Service (DoS) vulnerability due to invalid character sequences in PDO PostgreSQL prepared statements. These vulnerabilities can lead to severe consequences, including unauthorized access to sensitive data and service disruptions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update php-pecl-apcu-
< 0:5.1.23-1.module+el9.7.0+40004+bf50a5680:5.1.23-1.module+el9.7.0+40004+bf50a568 -
< 0:5.1.23-1.module+el9.7.0+40005+715283ec0:5.1.23-1.module+el9.7.0+40005+715283ec
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing input validation and sanitization to mitigate the risks associated with the vulnerabilities. Additionally, restrict access to sensitive functions and monitor logs for unusual activities.
Conclusion
In summary, the recent security vulnerabilities in PHP packages pose significant risks to web applications. It is crucial to update the affected packages to their patched versions to safeguard against potential exploits. Regular monitoring and maintenance of your software environment are essential to ensure ongoing security.
See every vulnerability recorded for php-pecl-apcu →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The potential impacts include unauthorized access to sensitive data, execution of arbitrary code, and Denial of Service, which can disrupt application availability.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to compromise systems.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed.
References
Related vulnerabilities
Recent vulnerabilities recorded for php-pecl-apcu.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
